e952b1c2c9a1a67e7bd95b7e56402420f21a6221a0273929d238998ef1f867ed

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04626a20af47a85eb01756646aed7d1e_JaffaCakes118.html
Size

141KB
MD5

04626a20af47a85eb01756646aed7d1e
SHA1

c0dab67d2c1cd2793002df25008c80850582a4f3
SHA256

e952b1c2c9a1a67e7bd95b7e56402420f21a6221a0273929d238998ef1f867ed
SHA512

ada06ad880dbff9ad63d836c7ccace400d9eeb417f8063171e0cfedfc3312424ca85550a9a70672ba1ff6fc6721ee37ddafd57848e1e86bd3d0a7a951aba3b73
SSDEEP

3072:SJ8FiXx7dyfkMY+BES09JXAnyrZalI+YQ:SJ8wXx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420440744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{979E9851-0518-11EF-A635-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE
1956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1956	2296	iexplore.exe	28
PID 2296 wrote to memory of 1956	2296	iexplore.exe	28
PID 2296 wrote to memory of 1956	2296	iexplore.exe	28
PID 2296 wrote to memory of 1956	2296	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04626a20af47a85eb01756646aed7d1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd9de35cfb7007daef1e0227e27b50ba

SHA1
071367d03a97cdd02a28f1a614feff85e30dd36a

SHA256
efe6e53b517ecf299f9cefcd9b8c11ea7030084dfdca42e0806e64b706a54f2f

SHA512
e6f9d1fadf8a06e5f8d1c3985734f5a7df665e420fe04f0e4c0fc3d11ed6a474251887dd71d79d2af12590d9e5bc421c564f0b44583fa2a0466e6c4070744072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
193e1456ee9e64b852361cd671979da7

SHA1
ae6f50f1a00ac056efdbf505b3a554e48111dc3f

SHA256
15ba0b38d81ba3838bb11a80fe4e249d31869a734793b6f5810578a7c7d37648

SHA512
ca8c6d196331849a57a342bab5f3ebb7964a3c493c71b9dfdb80d3a11b4dd3242240c9d604ddbe4b360cd31652a828ecf2dd85f099bc5c009fc999c544a92785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20713670f83722d2ec8717e90c83effa

SHA1
aa68a8cc0cc0ec2d8eb93f0273407c801b3ff16b

SHA256
5d38700cadeb4efa5782177df8477d39e160b193747a938e0a687417d058d7fc

SHA512
3c9e0aa3891f5a4f173a28e2489a88cf192f72dfd19684524bf5da8bb6c7bd9aec1be77af1a52c1c18f4ec4fc783606936862cb5c7116ff59d2d28265e1c65ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0168f22a3703fcab4ab5740a8728317a

SHA1
170813f69ab81e9f39b341112d3a877ac9d0ad05

SHA256
3f70545dcc5fd23f76cc71dd1d250a5abec73cb62befb6a904d1cc29d640a78c

SHA512
dfd95667046efaa7c9cfe93aaaf98b3b6d3655a010a8e8978d29cadd6312bebf187c72824989b005efd2a0dfb5bfce039bfc528844d96b8912bf3b3a90b8b1b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7343ca10615e5edeeff069b6f6638a7c

SHA1
318918640d80f7e4fad8db362d44ecc040acf81a

SHA256
ef4b96dee616367abfc84f2013b63e84a52b6e1a0ff9bc92568799c51c87e69f

SHA512
07cbd8496c82b40a0ea4b4310c80d3cbabee5a95bf6197e0214b02a3a1d567c46e0261472e94f10113f1e1abc0cf347dab667f756f10f6412966b209761e6c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a75acec60462bfe33a2907892a725882

SHA1
cbecaeaeda5ba2c96324224856d4ff8561cfa553

SHA256
06eab33ceb34a48f33b96eea309224a4de082ffec121176d3fd0e4fb1de4bc3f

SHA512
0071e929c1fa3805a2501f24736a8319e2d429c7b417062739f1559613c2a72646cb3f7a0d6a6d1e8d7aad5d4ce58cc7addc85b560f7782c71029995de3faf25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5784473115d5b7b7c9f342a116d0d4cd

SHA1
a06aeb391e503bce1fb53f4a11d070054aa76005

SHA256
e85fd9d6a40b0fce0cfb285c4e7184b6d5f729c87751c9083d1ff1bad5960282

SHA512
2ed40af4a3c4f55d879bdaecce9e3e13d98a66fa36f9cfb49188bb6b68b4161d40438b3706a77ec61ff13c98e016fef297f3d5dc964bef528e76563d70236dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f79a51f8b8780d4e77623c745f8549

SHA1
951298512277bebdde206a76d4fc896439c39805

SHA256
3817882616aff7d8566fc429bc1ac3f433b2dcbd76f04ef5ab1bf24fe8113958

SHA512
7ba7ac42d6507a0199f7bc48d42917ae1f4b56e495b07a9b2c9f50ee2d44839433fc6dc41539f324c9728e81974c3db244f68b1c5dc645821befd709ac782414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cba1329a5c5138e99d26b5a76cdf63fd

SHA1
e1756cf8f5aeb7d19b7c727e84c6db264f4a0f79

SHA256
97116fdd238b2fc4091d37a83ac755ab837333ca20f7fad207bd64fd2e7066c8

SHA512
c9080e0be044bc8947f5fbaa91c4fb5bcdb69e87e83fb6cb1f041c1cb20ef6b6f8d9c6b4b7e2bb15e1034bbe7a8cc355c0f85982efeb6a2344c447f10cbc7c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
234bb8ba87019171e77da0a7a8338ed0

SHA1
16ddd0fa17c7932449c40e6100e366d5bb4353dd

SHA256
06840ac4b41849f6d6604f582465348b73455a58858c7b9f7dd7ac6af7005b1d

SHA512
e35da983cac214e5b8fdd2abba81c347729b52386d93ad553826f362a0d59b31e73d0201c644d76e49299fc841f62c0effa6889544a5ff40b2ca586d564b3313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c33fce0cab7cd44b281e325639f85acf

SHA1
e36e8d7c03643ed4c4cdb3432d1b707d0f83a978

SHA256
717d16edaf419a34112b4cf3882eb8eca818d972899048c3a79d41c0f52b4844

SHA512
3bf38fb2cc0dcbc6ebc5fcf88974ebaebe70503d6ecfb649794ba8b7ec9bfa24433629852ccb741f12105a929009ccd37d7bca8d78ed634b3ab8190373dc88c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73a94b29762889990b1e4213fb8f6aa

SHA1
76fdeedf2616f0e0099791e7290304b5429b45fd

SHA256
cca5ba118495a1a5d31c7d2ced4ee76116d3445921c9cc80fd8501ad0492376e

SHA512
db9213172227ee4a3d063d28fecaccbc6259b9c116205006ef2827c730954156607d397ff24b4ce1e0e148b5e1ae1aa4c02bcfe734ac7e105e333266b9c83c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9acc0eac78736c508e8dfce49a4e5d23

SHA1
e99960891a2960c27165a12f7f5fa0cfecd5d1b8

SHA256
ffdd2faaadee0c798399b8d39fa7bb56c63d00fe19a4ec1096c8bdbfe0e6663d

SHA512
30841692a2286e56e2bbd38f0a5f40658a3ba81116ab9b55983a9703b15aaa647ec4f08f91b4d7d85212a07ac034656e9418d8d74cfdd5c297bf8bfb02071884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea39b87f6b5dd95c7edda22669f02e0a

SHA1
519a5ff6a2fead0a6902e22f8154bb65cdaeffbf

SHA256
ed20b85c9fd26dd634465747e3488d3324cfd329bffe748f9158ffe9a216f6e4

SHA512
206383b41e90255b9e73e7c8fa1dbf579aa37f7659a5aefcec8189ec7019a844d52f07b847348d818dfa030eb43ac328534194e1247a8b0bd29e7be70a52589e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7795a28dab931d1902ad832795d67c0a

SHA1
2426264839e8847cb1aab8b9a343ceb36a9e34e3

SHA256
f15139596fa0123f60946f4468e155c02446bb157b44a5497e020311cc7e6f9c

SHA512
31482934afddc8e418b78d5ac99a02489f6655a781e2161bd46eaafa9dd32484bac70d6896e792186919170819e527f5ef1c16b48d550b35fe21605fd377f2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a6e88190b8a42c6fe7841bd2e288a08

SHA1
557c01aac44fae8e2d5b570444baee19b767e7b7

SHA256
6990a5eee9fa8038a789775335e97147682e0566aba1f8ddc5ba085d47ec2008

SHA512
f50fab3bc8f6dc2e884a811b99f07c7a84925d44c2fd7ce66cab84decd53c2a19f393b059e5f70d7937d09939d3b442d324be5952f677f711828536d4de8e818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
854e28da8e4a6c7bf3a22dcf46af96a4

SHA1
724611fa083debbebdc433edde56f4da818d318a

SHA256
29b6311e0ffab678b18598e8fc138fb435a9ee9987e43c4a8a09dd28f7bc0f0e

SHA512
46d25dd3ca226a45987e418912c2bd5f4d47273c11363b8b3ba2474d77b89ffd735b3ef176f56d9412e948e648f2f7ab3aaba004b707136d9dc7db3afa4f1c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
835d19488d526ffdf728db1a64ad75a2

SHA1
c1a54a59938182969bebe92ef8dee03dc709cca8

SHA256
8e62d15c095b7c56926a08397fecb9d5d8cd1f91166436bba44abb62144e8f65

SHA512
f8f82ab9e07fa1e3471b1693091acefd03a45b75f85bde89290b577c618df638cd44620534f8f506c4ce50d52f5f59ada9d2b13a55b693990dadfeb63f58f145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5af1d76c57a44970f82c875e92e98263

SHA1
03ebdc337a6a03552dff8931662021fbf601b331

SHA256
532cd4b800b3df289b492c6e558b4ac02715a244500a43ec6e03c742ea4e3aab

SHA512
b53b23c5c0772470c8ddeb9b066102f0e92f9a3989482c400a654fe92b6531b4a6489176f013a5caa74405f82445266f84efd528cd5b109a67a3876a668b3cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2E05.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F05.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit